Reject all cookies?

Should a „Reject all cookies“ button be present in the cookie banner?

Many people find the banners that prompt them to consent to the use of various cookies when accessing a website annoying. A „Reject All Cookies“ button does not exist on many websites. Instead, one must navigate through a settings menu and disable the setting of cookies there. To be able to continue browsing quickly, users often prefer to give their consent. Web page operators take advantage of this „laziness“ to achieve the highest possible consent rate.

The question is how to evaluate the absence of a „Reject all cookies“ button.

The fact is that consent from the user is required to set non-essential cookies (i.e., especially those for marketing analysis).

By judgment of 1 October 2019 (Case C-673/17), the Court of Justice confirmed a general consent requirement for all such cookies that are not strictly necessary for the operation of a website and the provision of the page function for technical reasons.

With its decision of 28 May 2020 (I ZR 7/16 – Cookie Consent II – BGH Judgment on Cookies), the Federal Court of Justice (BGH) has also clarified the exact requirements for consent to the storage of cookies.

Site operators that wish to continue using cookies that are not technically necessary have since been required to implement effective consent solutions on their websites. 

But does a button in the cookie banner must now be present that immediately rejects the setting of all cookies?

The data protection authorities seem to agree on this: Consent to cookies should be as easy to obtain as it is to refuse them.

For example, the French data protection authority CNIL (Commission Nationale de l’Informatique et des Libertés) has urged about 60 companies to adapt their practices regarding the design of cookie banners and, in particular, to make the rejection of cookies as easy as accepting them (press release in English here). This approach is part of the measures to enforce the regulations published by the CNIL„Guidelines and recommendations for the use of cookies and other tracking technologies“.

The Italian data protection authority, Garante, also expressed itself in this regard. In a statement, Garante guidelines on cookies does this:

„The mechanism that allows continued browsing without consent must be as user-friendly and accessible as the mechanism for granting consent.“

And further: „To ensure that users are not influenced by the design of a cookie banner, so that they choose the other option, it is fundamental that commands and characters are used in the same size, emphasis and color, and that all these commands and characters are equally easy to see and use.“

On December 31, 2021, the CNIL imposed a fine of a total of 150 million euros (90 million euros for Google LLC and 60 million euros for Google Ireland Limited) on Google for the reason that users of google.fr and youtube.com cannot easily reject cookies as they are supposed to accept them.

Google also had trouble in Germany. The NRW Consumer Center has filed a lawsuit against Google with the LG Berlin, and has justified this as follows: By using tricks in the design of cookie banners, companies try to extort consumers’ consent in order to obtain as much personal information as possible, collect and process it. It must be as easy for consumers to reject cookies as it is to accept them. Only in this way can careless disclosure of data be prevented. A user only needs to click once on Google to accept all cookies. However, if they choose to only allow necessary cookies, they must first access a different control level within the cookie dialog. On this level, they must then at least three different categories of cookies must be rejected individually. In doing so, Google violated the standards set out in the Telecommunications Media and Data Protection Act (TTDSG) as well as EU law.

In the context of the complaint by the NRW Consumer Center, Google then announced that the practice in question would be discontinued and that a „Reject All Cookies“ button would soon be available across Europe in the cookie banners, in order to comply with the instructions of the supervisory authorities. Google has now equipped its own cookie banners in the search engine, among other places on its German website, with a „Reject All Cookies“ button as the new Google standard.

Additionally, private initiatives are also increasing the pressure on companies to revise their cookie banners. The data protection organization noyb („none of your business“) filed a whole 422 complaints in European supervisory authorities.

We therefore strongly recommend using a „Reject All Cookies“ button in conjunction with the “Agree” button for cookie banners. Only in this way can it be ensured that there is a voluntary and therefore data protection-compliant consent from the website user.

When you revise your cookie banner, please note the following points in particular:

A good one Checklist Regarding the requirements for cookie banners, the Lower Saxony supervisory authority here published. Work through these, then you should be on the safe side.